Gmail, Yahoo and Outlook Bulk Sender Rules for Cold Email

Most guidance about the bulk sender rules for cold email was written for marketers with a 200,000 person newsletter list. Cold email works differently: small volumes, many mailboxes, one or two domains, and recipients who never asked to hear from you. The rules still reach you, just not in the places the DMARC vendors emphasize. This is what Google, Yahoo and Microsoft actually require, taken from their own documentation, and what changes for a sender under 5,000 a day.

Key takeaways

• Google's bulk sender requirements start at close to 5,000 messages a day to personal Gmail accounts, and messages from the same primary domain count together. Splitting across twelve mailboxes on one domain does not split the count.
• Google states that the sender guidelines do not apply to messages sent to Google Workspace accounts. Most B2B cold email goes to work mailboxes, so the bulk tier often does not apply, but the all-senders baseline always does.
• Bulk sender status has no expiration date. Cross the line once and the classification sticks.
• Spam complaints are the real threshold. Google recommends staying below 0.1% and says the rate should never reach 0.3%.
• Microsoft has enforced its own 5,000 a day rule since May 5, 2025, and rejects non-compliant mail outright with a 550 5.7.515 error rather than filing it as junk.

Do the bulk sender rules apply to cold email? The short answer

Partly, and the split matters. There are two tiers in each provider's documentation: a baseline that applies to every sender, and a stricter tier that applies to bulk senders.

The baseline reaches you at any volume. Google's email sender guidelines, effective February 1, 2024, require all senders to set up SPF or DKIM, transmit over TLS, keep valid forward and reverse DNS records for the sending IP, format messages according to RFC 5322, keep spam rates in Postmaster Tools below 0.3%, and avoid impersonating Gmail in From headers. One cold email a day has to meet that bar.

The bulk tier is where the 5,000 number lives, and where the one-click unsubscribe requirement lives with it. Whether you land in that tier depends on who you are emailing and how you count.

Google's rules: 5,000 a day to personal Gmail, counted per primary domain

Google's definition is precise. In its sender guidelines FAQ, Google states: "A bulk sender is any email sender that sends close to 5,000 messages or more to personal Gmail accounts within a 24-hour period. Messages sent from the same primary domain count toward the 5,000 limit."

Three things follow that cold email teams routinely miss.

First, only personal Gmail accounts count. Google is explicit that "the Email sender guidelines don't apply to messages sent to Google Workspace accounts. Sender requirements and Google enforcement apply only when sending email to personal Gmail accounts." A B2B list of work addresses at company domains is largely outside the bulk tier, even at high volume. Lists with founders, consultants and sole traders on gmail.com are not.

Second, the count is per primary domain, not per mailbox. Running twelve inboxes on one sending domain does not divide your total by twelve. It is one number.

Third, the classification is permanent. Google's FAQ states that bulk sender status "doesn't have an expiration date." A single heavy day can move you into the stricter tier for good, which is a reason to hold volume steady rather than run spikes.

For most cold email programs the arithmetic keeps you below the line anyway. At the safe ceiling of 30 to 50 sends a day per warmed inbox cited in the Indie Hackers infrastructure playbook, even fifty inboxes spread across ten domains produce roughly 2,000 a day in total, and only a fraction of those land at personal Gmail addresses. Our guide on how many cold emails to send per day works through those caps.

The spam rate thresholds: 0.1% recommended, 0.3% maximum, and November 2025

Volume is the entry criterion. Complaint rate is what actually gets you blocked.

Google's FAQ recommends keeping the spam rate reported in Postmaster Tools below 0.1% and preventing it from "ever reaching 0.3% or higher." Since June 2024, senders who exceed 0.3% are ineligible for mitigation, which means there is no queue to appeal into once you are over the line.

The enforcement has teeth now. Google's FAQ notes that "Starting November 2025, Gmail is ramping up its enforcement on non-compliant traffic." Red Sift's November 2025 analysis describes what that looks like at the SMTP layer: non-compliant senders receive 4.7.x temporary failure codes that rate-limit their mail, and 5.7.x permanent failures that block it outright.

Two practical points for cold senders. A 0.1% complaint rate is one complaint per thousand delivered messages, so a small campaign can breach it with a handful of annoyed recipients. And Postmaster Tools only reports domains with enough volume to register, so a very small sender may be flying blind on the exact number that decides their fate. If your mail is going quiet with no bounces, our post on cold emails going to spam covers the diagnosis.

Yahoo's rules and the two-day unsubscribe requirement

Yahoo moved at the same time as Google, in February 2024, and its requirements are close but not identical. According to the Yahoo Sender Hub best practices, all senders must implement SPF or DKIM and keep their spam rate below 0.3%.

Bulk senders have to do more: implement both SPF and DKIM, publish DMARC with a policy of at least p=none aligned to the From: domain, and implement a functioning List-Unsubscribe header supporting one-click unsubscribe under RFC 8058, with the POST method "highly recommended."

The requirement that differs most from Google's is the deadline. Yahoo says to "Honor unsubscribes within 2 days." Google recommends 48 hours. If your process is a weekly manual export of opt-outs, both providers consider that too slow.

Microsoft's May 2025 rules and the 550 5.7.515 rejection

Microsoft was later and, in one respect, stricter. As documented by dmarcian, Microsoft announced on April 4, 2025 that from May 5, 2025, domains sending 5,000 or more messages a day to Outlook.com, Hotmail.com and Live.com must pass SPF, pass DKIM, and publish DMARC with at least p=none aligned with SPF or DKIM.

The original plan was to route non-compliant mail to the junk folder. A May 2, 2025 update changed that to outright rejection, with the response "550 5.7.515 Access denied, sending domain [SendingDomain] does not meet the required authentication level." If you see that string in a bounce log, it is an authentication problem, not a content problem.

Microsoft's high-volume guidance goes beyond authentication. Mailgun's summary of the requirements lists reply-capable From and Reply-To addresses, a visible functional unsubscribe link, regular list hygiene and bounce management, and transparent subject lines. Unlike Google and Yahoo, Microsoft does not explicitly mandate RFC 8058 one-click unsubscribe.

Note the scope again: consumer Outlook, Hotmail and Live addresses. Microsoft 365 business tenants are a separate filtering path, which is where most B2B cold email lands. Provider differences on the receiving side are covered in our comparison of Google Workspace, Outlook and Zoho.

Google, Yahoo and Microsoft requirements side by side

Requirements as published by each provider and summarized as of September 2026. Check the source pages before you rely on any row, since all three have changed within the last two years.

One-click unsubscribe (RFC 8058) and whether cold email needs it

Google's bulk requirements say that marketing and subscribed messages must support one-click unsubscribe and include a clearly visible unsubscribe link in the body. RFC 8058 is the standard behind that: the message carries a List-Unsubscribe header with an https target plus a companion header declaring one-click support, so the mail client can show its own unsubscribe control and remove the recipient with a single request, with no landing page and no login.

Is a cold email a marketing message? Generally yes in most readings, since it is unsolicited commercial mail sent to a list. The safer position is to ship the header on every campaign regardless of volume, for three reasons.

1. It gives an irritated recipient a one-tap alternative to the spam button, which protects the complaint rate that decides your placement.
2. Opt-out obligations exist independently of provider rules under CAN-SPAM, CASL and PECR, which we cover in is cold email legal.
3. If you ever cross into the bulk tier, you are already compliant instead of scrambling.

SDRclose adds one-click unsubscribe support and a visible opt-out link to outbound mail, and records every opt-out on a permanent do-not-contact list that applies across the whole workspace, so a person who opts out of one sequence is excluded from all of them. Our data protection page covers export and deletion requests.

DMARC in 2026: why p=none is enough to start

DMARC is the record that tells receivers what to do when a message fails SPF and DKIM alignment. All three providers ask for it, and all three accept the weakest policy. Google's requirements state plainly that "Your DMARC enforcement policy can be set to none." Yahoo and Microsoft both accept p=none as well.

That makes the first step almost free. Publishing p=none changes nothing about how your mail is delivered. It turns on reporting, satisfies the requirement, and starts sending you aggregate reports showing which sources are sending as your domain.

The order that works: publish SPF and DKIM, confirm alignment for every sending source, publish p=none with a reporting address, read the reports for a few weeks, then tighten to quarantine and eventually reject once nothing legitimate is failing. Moving straight to reject before your sending sources are aligned is the fastest way to block your own mail.

What the bulk sender rules for cold email mean for a small sender

A short checklist that satisfies all three providers at any volume:

1. Publish SPF, DKIM and DMARC on every sending domain, not just the primary one.
2. Keep alignment intact so the From: domain matches the SPF or DKIM domain.
3. Watch complaint rate as your primary safety metric and treat 0.1% as the ceiling.
4. Ship one-click unsubscribe headers and a visible opt-out link on every campaign.
5. Process opt-outs within two days, automatically, to a list that applies across every sequence.
6. Keep bounce rates down with verified addresses, and see our post on acceptable bounce rates for the thresholds.
7. Spread volume across domains, and remember the count is per primary domain.
8. Re-check each provider's page quarterly, because these rules have changed twice since 2024.

Nothing here is legal advice, and enforcement of statutory opt-out rules varies by country, so run your process past counsel if you sell into regulated markets.

SDRclose handles the compliance mechanics by default: authentication checks on every connected mailbox with alerts when a DNS record breaks, per-mailbox caps, one-click unsubscribe, and a permanent do-not-contact list. The deliverability guide covers the setup end to end, and you can start a free trial and connect a mailbox to see the checks run against your own domain.